An enterprise logistics company maintains an on-premises automated warehouse control syste… — CompTIA Security+

An enterprise logistics company maintains an on-premises automated warehouse control system. A recent quantitative risk assessment revealed that a ransomware attack against the system's unpatched legacy operational technology (OT) controllers presents a Single Loss Expectancy ( $SLE$ ) of $\$600,000$ with an Annual Rate of Occurrence ( $ARO$ ) of $0.25$ , yielding an inherent Annual Loss Expectancy ( $ALE$ ) of $\$150,000$ . Because vendor patches do not exist for the legacy OT controllers, complete system decommissioning is commercially unviable. The Chief Information Security Officer (CISO) approves a multi-part risk response: purchasing a targeted cyber insurance policy with a $\$20,000$ annual premium that covers up to $\$500,000$ of operational interruption losses per event, while deploying compensating network microsegmentation and passive anomaly detection at an annual cost of $\$15,000$ . If the technical compensating controls successfully reduce the $ARO$ to $0.05$ , which of the following statements correctly evaluates the financial impact and risk response strategies implemented by the organization?

The organization deployed risk mitigation to reduce threat frequency, achieving a net annual financial benefit of $\$105,000$ from technical controls, while using risk transference to address residual financial exposure.Answer
B
The organization primarily achieved risk avoidance by deploying compensating network microsegmentation, which completely eliminates the Single Loss Expectancy of the legacy controller vulnerability.
C
The technical compensating controls and insurance policy together create an increased Annual Loss Expectancy ( $ALE$ ) of $\$35,000$ because all control costs and premiums must be added directly to the inherent $ALE$ .
D
Purchasing the cyber insurance policy represents risk acceptance because the organization retains full operational responsibility for restoring the OT controllers following a incident.

Answer

The organization deployed risk mitigation to reduce threat frequency, achieving a net annual financial benefit of

\$105,000

from technical controls, while using risk transference to address residual financial exposure.

The correct response accurately applies quantitative risk analysis formulas and risk terminology. The inherent ALE is

\$600,000 \times 0.25 = \$150,000

. Technical controls lower the ARO to

0.05

, producing a post-control ALE of

\$600,000 \times 0.05 = \$30,000

. The loss reduction of

\$120,000

minus the control cost of

\$15,000

yields a net annual financial benefit of

\$105,000

. Implementing controls to lower occurrence frequency represents Risk Mitigation, whereas purchasing cyber insurance shifts financial loss liability to an insurer, representing Risk Transference.

Step-by-Step Solution

Calculate the inherent Annual Loss Expectancy (ALE)

\text{ALE}_{\text{inherent}} = \text{SLE} \times \text{ARO}_{\text{initial}} = \$600,000 \times 0.25 = \$150,000

Establishing baseline annual expected losses prior to control deployment.

Calculate the residual ALE following technical control deployment

\text{ALE}_{\text{residual}} = \text{SLE} \times \text{ARO}_{\text{new}} = \$600,000 \times 0.05 = \$30,000

Determining annual expected loss after reducing threat occurrence frequency via microsegmentation and detection.

Calculate the net annual financial benefit of the mitigation controls

\text{Net Benefit} = (\text{ALE}_{\text{inherent}} - \text{ALE}_{\text{residual}}) - \text{Control Cost} = (\$150,000 - \$30,000) - \$15,000 = \$105,000

Subtracting annual control maintenance costs from the total annual loss reduction gives the net monetary value of the safeguard.

Classify the complementary risk response strategies

Technical controls reduce likelihood (Risk Mitigation), while cyber insurance shifts monetary impact to a third party (Risk Transference).

Selecting security controls and financial hedging options maps directly to CompTIA Security+ risk response definitions.

Key Concept

Quantitative Risk Assessment and Risk Response Strategy Selection

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic